lerid

These adversarial inputs have been shown to generalize to separately trained models.

This seems like an obvious thing to try, but technically the convolutional structure already looks at different scales (in a way similar to mipmaps).

These adversarial inputs have been shown to generalize to separately trained models.

Did you read the article?

> We find that both adversarial training and defensive distillation accidentally perform a kind of gradient masking. Neither algorithm was explicitly designed to perform gradient masking, but gradient masking is apparently a defense that machine learning algorithms can invent relatively easily when they are trained to defend themselves and not given specific instructions about how to do so. If we transfer adversarial examples from one model to a second model that was trained with either adversarial training or defensive distillation, the attack often succeeds, even when a direct attack on the second model would fail. This suggests that both training techniques do more to flatten out the model and remove the gradient than to make sure it classifies more points correctly.